CVE-2026-6616

Summary

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extract_with_bs4/extract_with_3k/extract_with_lxml of the file superagi/helper/webpage_extractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
TransformerOptimusSuperAGI0.0.1affected
TransformerOptimusSuperAGI0.0.2affected
TransformerOptimusSuperAGI0.0.3affected
TransformerOptimusSuperAGI0.0.4affected
TransformerOptimusSuperAGI0.0.5affected
TransformerOptimusSuperAGI0.0.6affected
TransformerOptimusSuperAGI0.0.7affected
TransformerOptimusSuperAGI0.0.8affected
TransformerOptimusSuperAGI0.0.9affected
TransformerOptimusSuperAGI0.0.10affected
TransformerOptimusSuperAGI0.0.11affected
TransformerOptimusSuperAGI0.0.12affected
TransformerOptimusSuperAGI0.0.13affected
TransformerOptimusSuperAGI0.0.14affected

Weaknesses

  • CWE-918: Server-Side Request Forgery

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References